% in error message being encoded into %% (by Tornado HTTPError)

[ptch314]

Description

We have a use case where the server is expected in some cases to return a “400 Bad Request” response with a message that includes a URL-encoded string. However, the URL-encoded text unexpectedly comes back with all %s being transformed into %%s. We want to know if this is a bug in Jupyter, a bug in a Jupyter dependency (Tornado), or expected behavior that we need to work around.

Reproduce

The issue is difficult to reproduce without running a server that returns an error message with % characters in the HTTP response.

To elaborate, the %s come from us wanting to return an error message with a nested, URL-encoded URL that already has encoded symbols, such as https://example.com/?redirect=http%3A%2F%2F. But because of the issue, they are being returned as https://example.com/?redirect=http%%3A%%2F%%2F instead.

Context

• Operating System and version: N/A
• Browser and version: N/A
• Jupyter Server version: v2.15.0

We looked into the Jupyter Server source code, and identified the root cause is likely https://github.com/jupyter-server/jupyter_server/blob/c67a46befdcc972436150e9876b5d25d3c33ea56/jupyter_server/gateway/gateway_client.py#L789-L793, where it is calling the HTTPError constructor with an f-string log_message argument to inject placeholder values instead of using the syntax expected by Tornado of %s in log_message and placeholder values in the args. This is compounded by Tornado encoding all %s in the log_message (but not in the args) into %%s.

https://www.tornadoweb.org/en/stable/_modules/tornado/web.html#HTTPError

        if log_message and not args:
            self.log_message = log_message.replace("%", "%%")